You backed up your domain controllers. Why not your Entra ID?

If you ran Active Directory in the 2000s or 2010s, you probably remember the rules by heart. Never fewer than two domain controllers. System state backup every night. Tapes rotated off-site on Friday. The DSRM password sealed in an envelope in the safe. And at least once a year, somebody nervously rehearsed an authoritative restore in a lab, just to make sure it actually worked.

We did all that because we knew that if the directory was gone, everything was gone. No logons, no file shares, no email, no line-of-business apps. Identity was the foundation, and we treated it that way.

Then we moved to Microsoft 365 and Azure, and somewhere along the way most of us quietly stopped doing it.

How we protected identity on-prem

The on-prem playbook for Active Directory was layered, and every layer solved a different problem:

• Secondary domain controllers gave us availability. Lose a server, and the other DCs kept authenticating users.
• System state backups to disk and tape gave us recoverability. Replication is not a backup: if someone deletes an OU, the deletion replicates to every DC within minutes. Only a backup lets you go back in time.
• Off-site tapes gave us isolation. If the server room burned down, or later on, if ransomware encrypted everything on the network, the tapes on the shelf were untouched.
• Change auditing and restore drills gave us confidence. We knew what had changed, and we knew we could undo it.

Availability, recoverability, isolation and visibility. Keep those four words in mind.

Then we moved to the cloud, and forgot

When Azure AD (now Microsoft Entra ID) took over as the identity platform, availability became Microsoft’s problem, and they are very good at it. That was a relief, and I think it’s exactly why so many organisations assumed the rest was handled too.

It isn’t. Microsoft’s shared responsibility model is clear: Microsoft runs the service, but the data and configuration inside your tenant are your responsibility. Your users, groups, role assignments, app registrations, enterprise applications and Conditional Access policies are yours to protect. And Entra ID’s built-in safety net is thin:

• The recycle bin keeps soft-deleted users, groups and apps for 30 days. After that, or after a hard delete, they’re gone.
• Many object types and settings were never covered by the recycle bin at all. A Conditional Access policy that someone “temporarily” edits, an app registration whose secrets and permissions get changed, an attribute overwritten by a faulty sync job: there’s no undo button for most of that.
• A compromised Global Administrator account can do a lot of damage in very little time, inside the same admin plane you’d use to recover.

And the stakes are higher than they were on-prem. Entra ID doesn’t just control access to Microsoft 365. It’s the front door for Azure, for hundreds of SaaS apps via single sign-on, and increasingly for AI agents and other non-human identities. If your directory is broken, rebuilding it by hand from memory and old screenshots is slow, error-prone and exactly the moment you’re most likely to miss a security control.

Regulation is pushing the same way. NIS2 and DORA both expect organisations to be able to demonstrate that they can recover critical systems. It’s hard to argue identity isn’t one of them.

Microsoft is moving, but it’s not a backup strategy (yet)

Timely news: on 19 March, Microsoft put Entra Backup and Recovery into public preview. It takes an automatic daily snapshot of supported Entra ID objects, keeps five days of history, lets you generate a difference report against the current state, and restore everything or just selected objects. It comes at no extra cost.

That’s genuinely good, and you should switch it on. But measure it against the four words from the on-prem days:

• Retention: five days. Many misconfigurations and most well-hidden intrusions are discovered later than that.
• Isolation: the backup lives in the same tenant and is managed from the same admin plane an attacker would be using.
• Coverage: it can’t recreate hard-deleted objects, it’s limited to workforce tenants, and not every object or attribute is supported in preview.
• Frequency: once a day.

Think of it as the recycle bin’s bigger sibling: the equivalent of the second DC, not the tape on the shelf. You still need an independent copy, outside the tenant, with retention that matches your compliance requirements.

The bonus: identity makes your backups smarter

Here’s the part I find most interesting, and it’s an argument that didn’t really exist in the tape days.

Traditional backup sees data. It can tell you that 40,000 files in OneDrive changed overnight, but not why. Was it a legitimate migration, a sync client gone wrong or ransomware? Identity data supplies the missing context. When your backup platform also protects Entra ID, it can line up two timelines:

• What changed in identity: a new app registration with broad Graph permissions, a Conditional Access policy disabled, a user suddenly added to a privileged role, a service principal that’s never been used before.
• What changed in the data: mass deletions, unusual encryption patterns, a spike in modified files under a specific account.

Put those side by side and a lot of questions answer themselves. Which account (or which app) did this? When did the attacker get in, so which restore point is actually clean? What’s the blast radius? And in what order do you recover: first the identity configuration that let them in, then the data they touched. Restoring files while the malicious app registration is still sitting in your tenant just gives the attacker a second go.

This is where the market is heading: from “we have a copy” to “we understand what happened and can recover to a trusted state”. Which brings me to the solutions.

Three ways to get it done

There are plenty of products that back up Entra ID. These are three I work with and know well. They overlap on the basics (users, groups, roles, app registrations, enterprise applications and Conditional Access policies are covered by all three) but each has a clear sweet spot.

Druva: identity resilience across hybrid and multi-IdP estates

Druva is a 100% SaaS platform, and Entra ID backups are stored in an isolated, air-gapped repository on AWS, completely outside your Microsoft tenant. Coverage includes users, groups, roles, devices, enterprise apps, app registrations, administrative units and Conditional Access policies, and you can bring your own keys via AWS KMS if key custody matters to you.

Where Druva stands out is relationships and context. It doesn’t just put an object back; it restores its settings and relationships too, so a restored group comes back with its memberships. You can compare objects between snapshots before you restore. And just last week, on 17 March, Druva announced Druva Identity Resilience, which adds on-prem Active Directory and Okta alongside Entra ID in one platform. The idea is to track identity state over time and correlate relationships and behaviour, which is exactly the “smarter backup” angle above. Some of the deeper threat detection and response capabilities are still listed as coming soon, so check the roadmap against your needs.

Druva excels when: you run hybrid identity (AD plus Entra ID, maybe Okta too), you want backups fully isolated from Microsoft, and security and IT need to work from the same picture during an incident. It’s also a natural fit if you already use Druva for Microsoft 365, Azure or endpoints.

AvePoint: Microsoft-centric backup with governance built in

AvePoint Cloud Backup for Entra ID runs up to four automatic backups a day, keeps them for as long as you need, and lets you store the data either in AvePoint’s Azure storage or in your own (bring your own storage). Restores can be time-based or object-based, and you can compare backups before restoring.

Its strength is drift. The hard part of recovering a directory is rarely the restore itself; it’s figuring out which of the hundreds of changes were malicious or accidental and which were perfectly valid changes from an ongoing project. AvePoint is built to surface configuration drift and let you restore with item-level precision: one user, a batch of policies, or an orchestrated mass recovery across your Microsoft cloud. Entra ID sits inside AvePoint’s broader multi-SaaS backup (Microsoft 365, Azure, AWS and more, including fast recovery via Microsoft 365 Backup Storage), and alongside its governance and policy tooling on the same platform.

AvePoint excels when: your world is mostly Microsoft, you care as much about governance and drift control as about backup, and you want granular, surgical restores. It’s also strong for MSPs managing many tenants.

Arrow Cloud Backup: a partner-delivered service, built for compliance

Arrow’s cloud backup for Microsoft Entra ID is delivered as a managed backup-as-a-service through Arrow’s partner channel, built on IBM Cloud. It’s true cloud-to-cloud backup, fully isolated from Microsoft 365, with immutable, air-gapped storage, AES-256 encryption, and backups as often as every hour. Retention is flexible, from a day to unlimited.

Beyond the usual objects, it also captures the audit log and sign-in log, Identity Secure Score and licence overview, which is useful context when you’re investigating rather than just restoring. A change comparison tool shows what differs between a backup and the live tenant, every backup and restore action is logged for audit, and a security dashboard uses IBM watsonx.ai to give context-aware recommendations for tightening identity governance. It can be bundled with Arrow’s Microsoft 365 backup, so identity and content are protected (and restored) from one portal, with predictable annual pricing and GDPR “right to be forgotten” support.

Arrow Cloud Backup excels when: you buy through a local partner and want a simple, predictable service rather than another platform to operate, when compliance (GDPR, NIS2, DORA) and audit trails are front and centre, and when you want Microsoft 365 and Entra ID covered in one bundle. It’s a particularly good fit for small and mid-sized organisations and the partners who serve them.

Quick guide: which one fits?

• Hybrid identity, multiple identity providers, security-led recovery: start with Druva.
• Microsoft-heavy, governance and drift control matter, many tenants: start with AvePoint.
• Partner-delivered, compliance-driven, Microsoft 365 and Entra ID in one simple package: start with Arrow Cloud Backup.

Whichever you choose, keep Microsoft’s native Entra Backup and Recovery switched on as well. Fast, local rollback for yesterday’s mistake and an isolated long-term copy for the bad day are not either/or. It’s the same layered thinking as the second DC plus the tape.

Bottom line

We never would have run a domain without a backup of the domain controllers. Entra ID is that domain now, only bigger, more connected and more exposed. Moving to the cloud handed availability to Microsoft, but recoverability, isolation and visibility are still on us. And done right, backing up identity doesn’t just give you a way back; it makes the rest of your backups smarter about what actually happened.

If you want a second opinion on where your identity protection stands, or which of these approaches fits your setup, feel free to get in touch.

Sources: Druva – Entra ID backup, Help Net Security on Druva Identity Resilience (Mar 2026), AvePoint Cloud Backup for Entra ID, AvePoint on Microsoft AppSource, Arrow’s cloud backup for Microsoft Entra ID, Anycloud – Backup for Entra ID, Petri on Microsoft Entra Backup and Recovery. Data center photo: Victor Grigas / Wikimedia Foundation, CC BY-SA 3.0.